CVE-2024-45626CWE-400

Apache James: denial of service through JMAP HTML to text conversion

Medium · published February 6, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.

Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-02-06T11:21Z
EPSS history
Timeline
  • 06 FEB 11:21Z
    Apache James: denial of service through JMAP HTML to text conversion
    cvelistv5